SC-300 Identity and Access Administrator Practice Questions with Explanations
Free SC-300 Identity and Access Administrator practice questions with an explanation for every answer. Covers Microsoft Entra ID, users and groups, conditional access, multifactor authentication, identity governance, and access reviews.
Questions
To verify a custom domain in Microsoft Entra ID, you add:
- A TXT or MX record at your DNS host
- A CNAME record pointing to login.microsoftonline.com
- An SPF record listing your Exchange servers
- A new user named after the domain
A helpdesk team should reset passwords only for users in the Paris office. What's the best setup?
- An administrative unit with a scoped Helpdesk Administrator role
- A tenant-wide Helpdesk Administrator role for the whole support team
- A dynamic group for Paris and the User Administrator role
- A Conditional Access policy limited to the Paris IP range
Which feature stops even tenant-level admins from changing certain sensitive objects unless they're assigned at that scope?
- Restricted management administrative units
- Dynamic membership groups
- Protected actions in Conditional Access policies
- Cross-tenant access settings
Which is a correct dynamic membership rule for users in the Sales department?
- user.department -eq "Sales"
- user.department = Sales
- department == "Sales"
- user.department -has Sales
Dynamic membership groups require which license?
- Microsoft Entra ID P1
- Microsoft Entra ID Free
- Microsoft Entra Workload ID
- No license at all
Can you manually add a user to a dynamic membership group?
- No, the rule alone controls membership
- Yes, owners can add anyone they choose
- Yes, but only guest users
- Only if the group has fewer than 50 members
What does group-based licensing do?
- Members get licenses automatically when they join
- Charges the group owner for each member's license
- Removes licenses from users who aren't in any licensed group
- Lets users choose any license they want from a list
You need to create 300 users at once in the Entra admin center. What should you use?
- Bulk create with a CSV template
- The guest invitation wizard
- Entra Connect cloud filtering
- An access package request
What is the default maximum number of devices per user for join or registration?
- 50
- 5
- 10
- Unlimited
How does Microsoft recommend requiring MFA when users join or register devices?
- A Conditional Access policy for 'Register or join devices'
- The legacy device setting that requires MFA for every device join
- A custom role assigned to every user who joins a device
- An access review of each device after it joins
What does Windows LAPS with Microsoft Entra ID do?
- Rotates and stores the local admin password for Entra joined devices
- Removes the built-in local admin account from every Windows device
- Syncs local admin passwords to on-prem AD DS
- Gives every user local admin rights on their device
Which settings control who in your organization can invite guest users?
- External collaboration settings
- Cross-tenant access settings
- Authentication methods policy
- Administrative unit settings
You want B2B invitations allowed only to users at partner.com. What should you configure?
- Collaboration restrictions with an allow list
- A Conditional Access named location for partner.com
- An inbound trust setting for MFA
- A dynamic group for partner.com
You want to accept the MFA a partner's users already completed in their own tenant. What do you configure?
- Inbound trust settings in cross-tenant access
- Outbound access settings for your own users
- Guest invite settings in external collaboration
- An authentication strength for guest users
Which feature lets your users join another organization's Teams shared channels without guest accounts?
- B2B direct connect
- B2B collaboration
- External ID for customers
- Entra Cloud Sync
By default, guest users in a tenant have:
- More limited permissions than member users
- The same permissions as member users in the tenant
- Global Reader access to the directory
- No ability to sign in until approved
When a guest user accepts an invitation and signs in for the first time, this is called:
- Redemption
- Provisioning
- Federation
- Activation
Which sync tool uses lightweight provisioning agents and supports several agents for high availability?
- Microsoft Entra Cloud Sync
- Microsoft Entra Connect Sync
- Microsoft Identity Manager
- AD FS with Web Application Proxy
How often does Microsoft Entra Connect Sync run its default sync cycle?
- Every 30 minutes
- Every 5 minutes
- Every 2 hours
- Once a day
Which hybrid authentication method enables leaked credential detection in ID Protection?
- Password hash synchronization
- Pass-through authentication
- Federation with AD FS
- Seamless single sign-on
Why turn on password hash sync even if you use federation?
- As a backup sign-in method and for leaked credential detection
- Because federation requires PHS to work at all
- To remove the need for MFA on cloud apps
- To sync passwords back from Entra ID to on-prem AD DS, so they stay in step
How do you make pass-through authentication highly available?
- Install more PTA agents on other servers
- Turn on password writeback in Entra Connect
- Add a second Entra tenant for failover purposes
- Lower the sync interval
Seamless SSO gives users on domain-joined devices on the corporate network:
- Automatic sign-in without typing a password
- A second password just for cloud apps and SaaS services
- A one-time code sent by SMS
- Access to on-prem apps only
Which feature lets you test moving selected users from federation to cloud authentication?
- Staged rollout
- Seamless SSO
- Smart lockout
- Cross-tenant sync
Which service monitors the health of Entra Connect sync and AD FS?
- Microsoft Entra Connect Health
- Microsoft Defender for Cloud
- Entra ID Protection
- Azure Service Health
You need to sync users from only certain OUs. What do you configure?
- OU-based filtering in Entra Connect
- A dynamic group in Entra ID
- An access review of each OU
- A Conditional Access exclusion
Which Global Secure Access traffic forwarding profile handles traffic to Exchange Online and SharePoint Online?
- Microsoft traffic profile
- Internet access profile
- Private access profile
- Remote network profile
Remote users need an on-premises file server without a VPN. Which product fits?
- Microsoft Entra Private Access
- Microsoft Entra Internet Access
- Microsoft Entra Verified ID
- Microsoft Entra Connect Sync
In Private Access, what's the simplest way to publish a broad set of private FQDNs and IP ranges?
- Quick Access
- Per-app access
- Remote networks
- Universal tenant restrictions
Which product secures user access to public websites and SaaS apps, including web content filtering?
- Microsoft Entra Internet Access
- Microsoft Entra Private Access
- Microsoft Entra Permissions Management
- Microsoft Entra External ID
What do you install on Windows devices to send traffic through Global Secure Access?
- Global Secure Access client
- Azure Monitor Agent
- Entra private network connector
- Defender for Identity sensor
Which Conditional Access condition requires that traffic comes through Global Secure Access?
- Compliant network check
- Named location by country
- Device platform filter
- Sign-in risk level
Why turn on source IP restoration in Global Secure Access?
- So Entra ID sees users' original IPs for CA and risk
- So users can browse the internet without any filtering at all
- So private apps get public IP addresses
- So guest users can skip MFA prompts
Branch offices without the client installed can connect to Global Secure Access through:
- Remote networks
- Quick Access
- B2B direct connect
- Seamless SSO
A single dynamic membership rule can include both users and devices.
Which objects can you add to an administrative unit? (Select all that apply.)
- Users
- Groups
- Devices
- Azure subscriptions
- Conditional Access policies
Where should you manage MFA and SSPR methods centrally today?
- The authentication methods policy
- The legacy per-user MFA page
- Each user's profile, one at a time
- The Exchange admin center
Which Microsoft Authenticator feature makes users type the number shown on the sign-in screen?
- Number matching
- Location display
- Passkey sign-in
- Push fatigue mode
A new hire needs to set up passwordless sign-in without ever having a password. Which method helps?
- Temporary Access Pass
- SMS one-time code
- Security questions
- App password
Which built-in authentication strength allows only FIDO2, Windows Hello for Business, and certificate-based MFA?
- Phishing-resistant MFA strength
- Passwordless MFA strength
- Multifactor authentication strength
- Temporary access strength
You want admins to use phishing-resistant MFA. Which Conditional Access grant control fits?
- Require authentication strength
- Require multifactor authentication
- Require password change
- Require approved client app
Users sign in to Entra ID directly with smart cards or X.509 certificates. This method is:
- Certificate-based authentication
- Federated authentication
- Temporary Access Pass
- Seamless SSO
For administrator accounts, self-service password reset always requires:
- Two authentication methods
- One method only
- Security questions
- A manager's approval
What lets a cloud SSPR reset update the user's on-premises AD password?
- Password writeback
- Seamless SSO
- Staged rollout
- Pass-through authentication
To enforce banned passwords on on-premises domain controllers, you install:
- The Password Protection proxy and DC agent
- The Azure Monitor Agent on each DC
- A Global Secure Access client on each domain controller
- The Entra Connect Health agent only
How should you first roll out on-premises Password Protection to limit disruption?
- In audit mode
- In enforce mode
- With all DCs offline
- Only for admins
What is the default smart lockout threshold for failed sign-ins in Entra ID (public cloud)?
- 10 attempts
- 3 attempts
- 5 attempts
- 25 attempts
How can you test a new Conditional Access policy's impact without enforcing it?
- Report-only mode
- Enable it for all users
- What If on one user only
- Turn on security defaults
Which tool shows which Conditional Access policies would apply to a simulated sign-in?
- What If
- Report-only mode
- Sign-in frequency
- Identity Secure Score
Which accounts should you exclude from Conditional Access policies to avoid locking yourself out?
- Emergency access (break-glass) accounts
- All guest users
- Every member of the IT department and helpdesk
- Service principals used by apps